📄 Security

X-Content-Type-Options Header Check

Confirm X-Content-Type-Options is set to nosniff and explain MIME-sniffing risks when the header is missing.

X-Content-Type-Options header value (leave empty to simulate absence) Diagnosis

—

nosniff: stopping the browser from guessing the type

When the declared type on a response seemed not to match the content, older browsers tried to guess by looking at the first bytes. The intent was good — rescuing pages from misconfigured servers. The side effect was not: a user-uploaded file served as plain text but containing markup could end up interpreted as HTML and run script on the site's domain.

Paste the header value and the page says what it means. Only one valid value exists, and the check is literal: anything else is ignored by the browser, which in practice equals having no header at all. Absence is reported too, with the risk spelled out — it is the default state of anyone who never configured anything.

Beyond blocking the guessing, the header has a second effect that has become the main one: it makes the browser refuse scripts and stylesheets served with the wrong type. That is why a page starts reporting type errors once the header is switched on — it is not a regression, it is the server misconfiguration becoming visible. The fix is mapping the types correctly, not removing the protection.

Frequently asked questions

Is there any reason not to use it?

Practically none on a new site. On an old site, switching it on may break resources served with the wrong type — but that was already a defect, merely invisible. The right order is checking the declared types in a test environment and only then enabling it in production.

Does it replace Content-Security-Policy?

No, they solve different problems. This one prevents a response's type being reinterpreted; the content security policy controls where scripts and styles may come from. A sensible configuration has both, alongside the header against framing in an iframe.

Does it apply to every file type?

It applies to every response, but the practical effect concentrates where guessing would do damage: user-uploaded content, downloads and resources served from your own domain. Applying it everywhere is simpler and costs nothing — the header takes a handful of bytes.

Related Tools

🛡️

Basic CSP Evaluator

Evaluates a Content-Security-Policy directive reporting unsafe-inline, unsafe-eval or wildcard issues.

🛂

CORS Preflight Explainer

Given a CORS request method and headers, shows whether it triggers an OPTIONS preflight and explains why.

🧹

Clear-Site-Data Header Builder

Build a Clear-Site-Data header (cache, cookies, storage, executionContexts) — useful on logout to wipe origin data.

🔒

HSTS Header Builder

Builds the Strict-Transport-Security header with max-age, includeSubDomains and preload as selected.

🔒

HSTS Header Builder

Assembles a Strict-Transport-Security header line from a max-age in seconds plus optional includeSubDomains and preload directives, ready to paste into a config.

⚠️

Cache-Control Security Check

Analyse Cache-Control and warn when sensitive content may be cached by proxies (missing no-store, private, etc.).